covert-network-triggers
Installation
SKILL.md
Covert Network Trigger System
Overview
Multi-protocol trigger system for waking dormant processes via network packets. Payload data is encoded within legitimate protocol fields so triggers appear as normal network traffic. Each protocol uses a different encoding strategy.
Trigger Types
| Protocol | Encoding Method | Payload Location |
|---|---|---|
| ICMP Ping | Timestamp field | Milliseconds field of ICMP timestamp data (2 bytes per ping) |
| ICMP Error | Header fields | IP ID (2B) + dest IP (4B) + TCP src port (2B) + seq number (4B) |
| TFTP WRQ | Base64 filename | Base64-encoded payload as TFTP write request filename |
| DNS Query | Base64 subdomain | Base64-encoded payload as DNS query subdomain |
| Raw TCP/UDP | XOR in random data | XOR-encoded within random packet fill, CRC at computed offset |